name: Deploy to K3s on: push: branches: - main # Or your default branch env: # Set your image name, adjust if your GitHub username/org is different from the repo owner # Or if your repo name is not what you want for the image name. IMAGE_NAME: ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }} K8S_NAMESPACE: aprs-app jobs: build-and-push-image: runs-on: ubuntu-latest permissions: contents: read packages: write # Needed to push to GHCR steps: - name: Tailscale uses: tailscale/github-action@v3 with: oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }} oauth-secret: ${{ secrets.TS_OAUTH_SECRET }} use-cache: "true" - name: Checkout code uses: actions/checkout@v4 - name: Set up QEMU uses: docker/setup-qemu-action@v3 - name: Set up Docker Buildx id: buildx uses: docker/setup-buildx-action@v3 - name: Login to GitHub Container Registry uses: docker/login-action@v3 with: registry: ghcr.io username: ${{ github.actor }} password: ${{ secrets.GITHUB_TOKEN }} - name: Extract metadata (tags, labels) for Docker id: meta uses: docker/metadata-action@v5 with: images: ${{ env.IMAGE_NAME }} tags: | type=sha,prefix= type=raw,value=latest,enable={{is_default_branch}} - name: Build and push Docker image uses: docker/build-push-action@v5 with: context: . push: true tags: ${{ steps.meta.outputs.tags }} labels: ${{ steps.meta.outputs.labels }} cache-from: type=gha cache-to: type=gha,mode=max deploy-to-k3s: runs-on: ubuntu-latest needs: build-and-push-image if: github.ref == 'refs/heads/main' # Only deploy from main branch steps: - name: Checkout code uses: actions/checkout@v4 - name: Set up Kubeconfig uses: azure/setup-kubectl@v3 # A popular action for kubectl # Alternatively, can do this manually: # run: | # mkdir -p $HOME/.kube # echo "${{ secrets.KUBE_CONFIG_DATA }}" | base64 -d > $HOME/.kube/config # chmod 600 $HOME/.kube/config - name: Install Kustomize (optional, but good for managing overlays) run: |- curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash sudo mv kustomize /usr/local/bin/ # If not using kustomize, this step can be removed. # For now, we'll use kubectl apply -f directly for simplicity. - name: Substitute Image Tag in Kubernetes Manifest run: | # The meta step outputs tags like: ghcr.io/owner/repo:sha-xxxxxxx,ghcr.io/owner/repo:latest # We need to pick the SHA-based tag. # github.sha gives the commit SHA, which is perfect for a specific tag. ACTUAL_IMAGE_NAME_WITH_TAG="${{ env.IMAGE_NAME }}:${{ github.sha }}" echo "Using image: $ACTUAL_IMAGE_NAME_WITH_TAG" # Create a temporary deployment file for substitution cp k8s/app-deployment.yaml k8s/app-deployment-processed.yaml # Replace placeholder image in the processed file # Using a different delimiter for sed due to slashes in image name sed -i "s|your-ghcr-username/aprs-app:latest|$ACTUAL_IMAGE_NAME_WITH_TAG|g" k8s/app-deployment-processed.yaml # Ensure initContainer is also updated (duplicate sed command is fine, ensures both are hit if structure changes) sed -i "s|your-ghcr-username/aprs-app:latest|$ACTUAL_IMAGE_NAME_WITH_TAG|g" k8s/app-deployment-processed.yaml - name: Apply Kubernetes manifests env: KUBE_CONFIG_DATA: ${{ secrets.KUBE_CONFIG_DATA }} # Pass secret to env for kubectl if not using azure/setup-kubectl run: | # Ensure Kubeconfig is set up if not using an action if [ ! -f "$HOME/.kube/config" ] && [ -n "$KUBE_CONFIG_DATA" ]; then mkdir -p $HOME/.kube echo "$KUBE_CONFIG_DATA" | base64 -d > $HOME/.kube/config chmod 600 $HOME/.kube/config echo "Kubeconfig set up manually." elif [ ! -f "$HOME/.kube/config" ] && [ -z "$KUBE_CONFIG_DATA" ] && [ -z "$(kubectl config current-context 2>/dev/null)" ]; then echo "Kubeconfig not found. KUBE_CONFIG_DATA secret is not set or empty, and no context is set by azure/setup-kubectl." exit 1 fi # Apply namespace first kubectl apply -f k8s/namespace.yaml # Apply secrets if a real one exists (checking for secrets.yaml, not secrets.yaml.example) # This assumes you will create the actual secrets.yaml in a secure way or it's handled by another process. # For this automated workflow, we'll only apply if the example isn't the only one. # A better way is to manage actual secrets outside the repo & this flow. # For now, we expect secrets to be pre-applied or managed via a more secure mechanism. # So, we will NOT apply secrets.yaml.example here. The user must ensure secrets are present. echo "Ensuring secrets are present in namespace ${{ env.K8S_NAMESPACE }}. This workflow does not apply them directly from a .example file." # Apply other resources kubectl apply -f k8s/postgres-pvc.yaml --namespace=${{ env.K8S_NAMESPACE }} # It's good practice to check if a resource exists before applying or use --overwrite, but apply usually handles this. # For sensitive or stateful things like Postgres, ensure your strategy for updates is clear. kubectl apply -f k8s/postgres-deployment.yaml --namespace=${{ env.K8S_NAMESPACE }} kubectl apply -f k8s/postgres-service.yaml --namespace=${{ env.K8S_NAMESPACE }} # Apply the processed app deployment kubectl apply -f k8s/app-deployment-processed.yaml --namespace=${{ env.K8S_NAMESPACE }} kubectl apply -f k8s/app-service.yaml --namespace=${{ env.K8S_NAMESPACE }} echo "Deployment to K3s initiated." # Optional: Wait for rollout to complete # kubectl rollout status deployment/aprs-app-deployment --namespace=${{ env.K8S_NAMESPACE }} --timeout=120s